In fact they do not have to have that permission. There is a (truck wide) hole in the law that allows disclosure for treatment or business purposes. Both of your examples would fall under this exception.